Narrow waist
Untrusted input enters through one gateway. Internal workers never parse raw webhooks — only attested HooxSignal intents.
Ten specialized Cloudflare® Workers and two storage surfaces, private Service Bindings, and a single public waist. Hover a node for bindings. Click for detail.
Constraints that keep the mesh small, fast, and hard to misuse — the same rules that shape ingress, execution, and storage.
Untrusted input enters through one gateway. Internal workers never parse raw webhooks — only attested HooxSignal intents.
Service Bindings keep the mesh off the public internet. No TLS hop, no DNS, no accidental exposure of execution paths.
Durable Objects lock every signal key before exchange calls. TradingView® retries become no-ops, not double fills.
D1, KV, R2, Vectorize, and Analytics Engine sit next to compute. Logs and state travel with the isolate, not a central region.
Direct V8-to-V8 calls — no public endpoints, no TLS hop between workers. The runtime spawns the target isolate and passes memory pointers; microservice hops complete in under a microsecond.
Binding latency
V8-to-V8 invoke — same thread, no network stack
Public routes
Everything else is isolate-private
Internal auth
Shared bearer on every service-to-service hop
Concentric corridors from the Cloudflare® edge to the Durable Object mutex. Every layer can independently reject a signal.
Cloudflare® WAF drops non-TradingView® IP ranges and rate-limit breaches before application code runs.
Gateway matches apiKey / HMAC against CONFIG_KV secrets. Mismatch → 401, no downstream fan-out.
Internal workers expose zero public HTTP. Reachable only as V8 Fetcher targets from other isolates.
requireInternalAuth on every binding hop. Same INTERNAL_KEY secret family across the mesh.
IdempotencyStore locks the signal key before exchange APIs. Retries return success without re-ordering.
WAF → passkey → Service Bindings → INTERNAL_KEY → Durable Object lock. See Ingress for the gateway path in detail.
A TradingView® webhook signal traverses the mesh in under 50ms on the happy path — validate, execute, persist, notify.
Every trade signal carries a unique idempotency key. Before executing, trade-worker (via the gateway handshake) checks the IdempotencyStore Durable Object. If the key exists, the order already ran — the duplicate is dropped. TradingView® webhook retries cannot double-fill.
telegram-worker embeds a retrieval-augmented assistant on Cloudflare® Vectorize — docs and trade history as the corpus, three commands as the surface.
/searchSemantic search over docs via Vectorize
/askLLM answer with source citations
/latestRecent market intelligence digest
report-worker runs on a configurable cron (default 06:00 & 18:00 UTC), aggregates performance from D1 / Analytics Engine, renders A4 PDFs with Cloudflare® Browser Rendering, stores them in R2, and notifies operators.
Prefer bare metal over Cloudflare®? HOOX ships a Bun-based self-hosted runtime. A single server entrypoint mirrors worker endpoints and runs on any VPS — same CLI, same signal contract, different substrate.
// server.js — Self-hosted HOOX runtime (Bun)
import { serve } from "bun"
import { trade, risk, notify } from "./lib"
serve({
port: 3000,
async fetch(req) {
const signal = await req.json()
const order = await trade.execute(signal)
await risk.assess(order)
await notify.telegram(order)
return Response.json({ status: "executed", order })
},
})
console.log("HOOX self-hosted → :3000")